full-disclosure - Mouseover URL spoof with IE

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <420B775D.5050902@sdf.lonestar.org>
From: bkfsec at sdf.lonestar.org (bkfsec)
Subject: Mouseover URL spoof with IE

Martin Stricker wrote:

><a href="http://bad-site.xx/"
>onmouseover="javascript:window.status='http://nice-site.xx';">blah</a>
>If you point your mouse over that link, you'll see "http://nice-site.xx"
>in the status bar, but clicking will lead you to http://bad-site.xx/.
>This is already widely used in spoof e-mails.
>
>[.xx is a ccTLD which, per RFC and ISO standard, will *never* be used,
>so my example domains will never exist. Just a precaution.]
>
>  
>
As a side-note...

This action is carried out by the browser's javascript interpreter and, 
as such, if you use a browser (like Mozilla) where you can disable the 
window.status JS object, this spoofing will not work.  (I'm sure that 
there are other ways to trick it, perhaps, but this does not work once 
it's disabled in the browser.)

             -Barry